Suspicious PowerShell RMM MSI Download

Brandon Rodriguez@BMRodriguez

•updated Mar 16, 2026•19•0•156

Detects PowerShell commands using Invoke-WebRequest to download and then execute an MSI file, a technique observed in campaigns deploying RMM tools like ScreenConnect and Tactical RMM. This is often done within a single command line or script block.